Re: [PATCH v3 1/2] KVM: x86: Check EFER validity on KVM_SET_SREGS*

[Yosry Ahmed]

On Wed, Jul 22, 2026 at 1:46 PM Sean Christopherson <seanjc@xxxxxxxxxx> wrote:
>
> On Mon, Jul 13, 2026, Yosry Ahmed wrote:
> > On Mon, Jul 13, 2026 at 11:02 AM Yosry Ahmed <yosry@xxxxxxxxxx> wrote:
> > >
> > > When handling userspace SREGS writes, check the validity of EFER (i.e.
> > > allowed bits) before writing the new value of EFER through the
> > > per-vendor set_efer callbacks. This prevents userspace from writing
> > > bogus values (e.g. EFER.SVME=1 with nested=0).
> > >
> > > Note: on KVM_SET_MSRS, KVM only checks EFER validity in terms of KVM
> > > caps, not guest caps, so it is possible to set EFER bits that are
> > > supported by KVM but not by the guest CPUID. Potentially allowing
> > > userspace to set msrs before CPUID.
> > >
> > > However, for KVM_SET_SREGS*, check the validity of the set bits against
> > > both KVM and guest caps. This is consistent with other validity checks
> > > (e.g. for CR4) that check validity against guest caps, which already
> > > imposes the need to set CPUID before SREGS.
> > >
> > > Cc: stable@xxxxxxxxxxxxxxx
> > > Change-Id: I45701ec440e4fdd8f086eb70db0c0845fb0ed509
> >
> > Forgot to drop these, sorry :/
>
> By "these", I assume you mean the Change-Id here and in the next patch?  But keep
> the Cc: stable@?

Yes, just the Change-Id.